The White-Label Telehealth Portal

Realtime media runs on its own host with its own relay infrastructure, deliberately separate from the application tier. A video relay is a machine whose whole job is to accept connections from strangers on the internet, which is exactly the profile you do not want on the same box as the patient record.

So the media host carries no patient data. It moves packets between two parties who have already been authenticated somewhere else. Compromising it gets you a busy relay and nothing to read.

Same call as the tax platform, and for the same reason. A shared database holding several clinics' patients means one authorization mistake exposes all of them, and the notification obligation is per patient, per state. Physical separation costs more and it means a bad day is one clinic's bad day.

Standing up a new clinic is one command: its own key namespace, its own service credentials, its own policies. Nothing is copied by hand, because anything copied by hand eventually gets copied wrong.

Intake, consent packets and visit documentation are signed through the same self-hosted signature service the tax platform uses, so the consent artifact and its audit trail stay inside the tenant boundary. When somebody asks two years from now what a patient agreed to and when, the answer is a sealed document with a hash chain behind it, not a row in a table that anyone with database access could have written yesterday.